Executive Summary
Enterprise AI agents are crossing a consequential boundary. They are no longer confined to generating text or recommending actions; they can access applications, retrieve sensitive data, call tools, write code and participate in business processes. That makes them productive—but also gives them the operating characteristics of privileged insiders.
The risk does not depend on an agent becoming malicious. An agent may follow an injected instruction, misunderstand a task, inherit excessive access or continue acting after its context changes. Because it operates at machine speed, a small deviation can become a material event before a human reviewer can intervene.
October’s key development is therefore architectural: enterprises are beginning to separate AI intelligence from organizational authority. The model can propose or reason, but identity, permissions, runtime containment and approval controls must remain outside the model. Microsoft’s newly announced approach reflects this shift, while independent analysis highlights unresolved questions about cross-vendor visibility and the wisdom of using AI agents to supervise other AI agents. Source: Microsoft Security, Source: Dark Reading
KEY STATISTIC
Among respondents completing the full 2026 Bank of England/FCA survey, 80% had AI agents deployed, while another 14% planned deployment within 12 months. Most current agents provided decision support; only 2% of respondents reported agents with broad autonomy. Source: Bank of England and Financial Conduct Authority
From Software Tool to Digital Insider
Conventional software executes predefined logic. An AI agent interprets objectives, selects actions and adapts as new information appears. To do useful work, it may need access to email, cloud storage, customer records, source-code repositories, payment workflows or other agents.
That combination—autonomy, access and adaptability—changes the security model. The question is no longer simply whether a model produces a safe answer. It is whether the enterprise can determine:
- Which agents exist and who owns them.
- What each agent is authorized to do.
- Which data and tools can it reach.
- Whether its current behavior remains aligned with its assigned task.
- How quickly can its authority be reduced or revoked.
- Whether every consequential action can be reconstructed afterward.
Microsoft’s October architecture proposes distinct agent identities, controlled runtimes, task-scoped permissions, continuous risk assessment and graduated containment. Its discovery layer now supports 60 types of local agents, illustrating how quickly enterprise agent estates are diversifying. Source: Microsoft Security
The Core Principle: Intelligence Must Not Control Its Own Authority
The most important idea is simple: the model should not be its own security boundary.
A sufficiently capable agent can still make an incorrect decision, misread an external document or be manipulated by a prompt hidden in data it processes. Asking that same model to decide whether its own behavior is safe creates a circular control structure.
Recommended agent-security architecture. Editorial synthesis based on Microsoft’s October architecture and independent security analysis. Source: Microsoft Security, Source: Dark Reading
This structure allows an enterprise to preserve useful activity while blocking dangerous actions. A suspicious expense agent, for example, might retain permission to read a policy but lose the ability to approve a transaction.
Why Existing Identity Controls Are Not Enough
Many early agents operate with a sponsoring user’s credentials. That is convenient, but it collapses accountability: logs may show what the user could access without distinguishing what the agent actually did on the user’s behalf.
An agent-specific identity provides a durable control point for ownership, access, attribution and termination.
| Control question | User-inherited model | Agent-specific model |
| Who performed the action? | Human and agent activity may be difficult to separate | Agent and sponsoring human are independently attributable |
| How much access is granted? | Often inherits the user’s standing permissions | Starts with no authority or narrowly scoped authority |
| How long does access last? | May persist with the user’s session or credentials | Expires when the task ends |
| How is abnormal behavior handled? | Session may need to be blocked entirely | Reads, writes, network paths or individual tools can be restricted |
| Who owns the risk? | Ambiguous between user, application and model provider | Named business and technical owners |
| Can the agent be retired cleanly? | Credentials and integrations may remain scattered | Identity, secrets and permissions can be revoked as one lifecycle |
Comparison table: inherited access versus first-class agent identity.
Banking and FinTech: Autonomy Meets Consequence
Financial institutions are likely to introduce agents first in coding, operations, customer support, compliance research and decision support. The joint UK survey suggests caution around direct financial execution: even after including planned deployment, no more than 9% of respondents expected agents to approve customer outcomes, execute trades, initiate or block payments, or change limits and controls. Source: Bank of England and Financial Conduct Authority
That caution is justified. In financial services, agent actions can affect:
- Customer eligibility and access to services.
- Fraud alerts and account restrictions.
- Payment release or beneficiary changes.
- Trading, treasury and liquidity decisions.
- Complaint handling and regulatory communications.
- Software changes to customer-facing or transaction systems.
For these processes, “human in the loop” is not enough if the person lacks context, time or authority to challenge the system. Human oversight must be probable, appropriately placed and tied to clear intervention thresholds.
Opportunity Without Unbounded Agency
The agentic-insider model should not be interpreted as an argument against enterprise agents. It is a blueprint for scaling them responsibly.
Near-term opportunities
- Faster deployment approvals: A reliable registry and risk-tiering model can accelerate low-risk use cases.
- Better accountability: Agent-specific identities create clearer operational and audit records.
- Reduced standing privilege: Task-bound authority limits the blast radius of errors and compromise.
- Continuous control: Policy can respond to changing behavior instead of relying exclusively on redeployment testing.
- Improved incident reconstruction: Independent logs preserve the evidence needed for investigation, complaints and regulatory review.
Material risks
- Agent sprawl: Employees and developers may deploy agents outside central governance.
- Prompt injection: Untrusted content can redirect an otherwise legitimate agent.
- Authorized misuse: The worst action may remain technically within the agent’s permissions.
- Supervisor-agent risk: Guardian agents are themselves powerful systems that require isolation and oversight.
- Vendor fragmentation: A bank may operate agents across several clouds, SaaS platforms and developer environments; no single provider necessarily sees the full chain.
Independent analysis also cautions that a proprietary control stack may provide incomplete visibility in multi-cloud environments. Open standards for agent identity, telemetry and revocation will therefore be as important as individual vendor capabilities. Source: Dark Reading
Enterprise Action Agenda
| Priority | Recommended action | Business outcome |
| Discover | Create an inventory of production, pilot, developer and locally installed agents | Make hidden agency visible |
| Identify | Assign each agent a unique identity, purpose, sponsor and technical owner | Establishes accountability |
| Constrain | Remove inherited permissions; issue task-specific, expiring access | Reduces blast radius |
| Isolate | Run agents in policy-controlled execution environments | Prevents agents from disabling their own controls |
| Observe | Correlate identity, data, endpoint, network, cloud and runtime signals | Detects behavior and intent drift |
| Intervene | Define graduated responses and mandatory human approval points | Preserves safe productivity while blocking harmful action |
| Retire | Revoke identities, secrets, tokens and integrations when agents are decommissioned | Prevents abandoned access paths |
Executive implementation matrix.
Looking Ahead
The enterprise-security center of gravity will move from “protect the model” to “govern the agentic estate.”
Identity platforms will need to recognize non-human actors as first-class entities. Privileged-access systems will have to grant authority by task rather than role alone. Security operations will require telemetry that explains not only what an agent did, but whether the action remained consistent with the approved purpose.
The long-term winner will not necessarily be the organization using the most capable model. It will be the organization that can give capable models useful access without surrendering control over authority.
Executive Takeaways
- Treat every production agent as a digital insider, not merely as an application feature.
- Separate intelligence from authority: identity, permissions and containment must sit outside the model.
- Do not let agents inherit a user’s full access. Grant task-specific, time-bound authority.
- Use continuous, graduated controls, not only approve-or-kill decisions.
- Design for multivendor visibility and auditability before the agent estate becomes fragmented.
